WO2021056731A1

WO2021056731A1 - Log data analysis-based behavior detection method, apparatus, device, and medium

Info

Publication number: WO2021056731A1
Application number: PCT/CN2019/117530
Authority: WO
Inventors: 秦威; 王智浩; 杨冬艳
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-09-23
Filing date: 2019-11-12
Publication date: 2021-04-01
Also published as: CN111221722B; CN111221722A

Abstract

Provided are a log data analysis-based behavior detection method, apparatus, device, and medium. The method enables: obtaining first log data of each functional node of a person to be detected in a preset system; calculating a first access frequency of each functional node of the person to be detected, retrieving the target access frequency of each functional node, and performing a comparison; if the first access frequency of a functional node is greater than the target access frequency, then from the first log data, determining the sequence of access to the functional node by the person to be detected, establishing a first queue of the functional node, and splitting the first queue to obtain a first group; retrieving a preset benchmark group, and matching the first group with the reference group; if there is a group matching failure in said first group, then carrying out security protection, determining that the behavior of the person to be detected is abnormal, detecting abnormal behaviors more comprehensively and accurately, and alerting relevant personnel.

Description

Behavior detection method, device, equipment and medium based on log data analysis

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on September 23, 2019. The application number is 201910900782.7. The title of the invention is "behavior detection methods, devices, electronic equipment and storage media". The entire content is incorporated by reference. In this application.

Technical field

This application relates to the technical field of security protection, and in particular to a behavior detection method, device, equipment, and medium based on log data analysis.

Background technique

In the existing technical solutions, the isolated forest algorithm is usually used to detect whether the user behavior is abnormal. However, because the isolated forest algorithm has extremely high requirements on the number of samples, the samples are not easy to obtain. At the same time, the isolated forest algorithm only corrects the number of visits. User behavior detection is low accuracy.

Summary of the invention

In view of the above, it is necessary to provide a behavior detection method, device, equipment, and medium based on log data analysis, which can detect abnormal behavior more comprehensively and accurately, and then alert relevant personnel to avoid information leakage.

A behavior detection method based on log data analysis. The method includes: when a behavior detection instruction is received, the first log data of each functional node of the person to be detected in a preset system is obtained through the burying technique; according to the First log data, calculate the first visit frequency of each functional node of the person to be tested; call the target visit frequency of each functional node; compare the first visit frequency of each functional node with the target of each functional node Access frequency; when the first access frequency of a functional node is greater than the target access frequency, determine the order of access to the functional node by the person to be detected from the first log data; establish the access sequence based on the access sequence The first queue of the functional node; split the first queue to obtain the first combination for the person to be tested to access the functional node; retrieve the pre-configured reference combination; combine the first combination with the The benchmark combination is matched; when there is a combination failure in the first combination, it is determined that the behavior of the person to be detected is abnormal.

A behavior detection device based on log data analysis, the device comprising: an acquisition unit, configured to obtain the first log of each functional node of a person to be detected in a preset system through a point-buried technique when a behavior detection instruction is received Data; a calculation unit, used to calculate the first access frequency of each functional node of the person to be tested according to the first log data; a retrieval unit, used to retrieve the target access frequency of each functional node; comparison Unit, used to compare the first access frequency of each functional node with the target access frequency of each functional node; determining unit, used to read from the first log when the first access frequency of the functional node is greater than the target access frequency The data determines the order in which the person to be tested visits the functional node; the establishment unit is configured to establish the first queue of the functional node based on the access order; the splitting unit is configured to split the first queue The queue is used to obtain the first combination of access to the functional node by the person to be tested; the call unit is also used to call a pre-configured reference combination; the matching unit is used to compare the first combination with the The reference combination performs matching; the determining unit is further configured to determine that the behavior of the person to be detected is abnormal when there is a combination matching failure in the first combination.

An electronic device, the electronic device comprising: a memory storing at least one instruction; and

The processor executes the instructions stored in the memory to implement the behavior detection method based on log data analysis.

A non-volatile readable storage medium, the non-volatile readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in an electronic device to implement the log data analysis-based Behavior detection methods.

It can be seen from the above technical solutions that this application can detect abnormal behaviors more comprehensively and accurately, and then remind relevant personnel to avoid information leakage.

Description of the drawings

Fig. 1 is a flowchart of a preferred embodiment of a behavior detection method based on log data analysis according to the present application.

Fig. 2 is a functional module diagram of a preferred embodiment of a behavior detection device based on log data analysis according to the present application.

FIG. 3 is a schematic structural diagram of an electronic device implementing a preferred embodiment of a behavior detection method based on log data analysis according to the present application.

detailed description

As shown in FIG. 1, it is a flowchart of a preferred embodiment of the behavior detection method based on log data analysis of the present application. According to different needs, the order of the steps in the flowchart can be changed, and some steps can be omitted.

The behavior detection method based on log data analysis is applied to one or more electronic devices. The electronic device is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Hardware includes, but is not limited to, microprocessors, application specific integrated circuits (ASICs), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc. .

The electronic device may be any electronic product that can perform human-computer interaction with the user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television ( Internet Protocol Television, IPTV), smart wearable devices, etc.

The electronic device may also include a network device and/or user equipment. Wherein, the network device includes, but is not limited to, a single network server, a server group composed of multiple network servers, or a cloud composed of a large number of hosts or network servers based on cloud computing.

The network where the electronic device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (Virtual Private Network, VPN), etc.

S10: When a behavior detection instruction is received, the first log data of each functional node of the person to be detected in the preset system is obtained by using the point burying technique.

In at least one embodiment of the present application, the behavior detection instruction can be triggered by the user, or can be triggered automatically when certain conditions are met, which is not limited by this application.

Wherein, the meeting certain conditions includes, but is not limited to: meeting the first preset time, etc.

The first preset time may include a determined time point, or include a time period, etc., for example: the first preset time may be 7 o'clock in the morning every day.

In at least one embodiment of the present application, the preset system is a business system corresponding to the work content of the person to be tested.

The functions of the business system may include marketing planning, sales, sales process management, customer service management, customer relationship management, risk prevention, etc.

The first log data refers to data that records a series of operations of the person to be tested on each functional node in the preset system, and the first log data plays an important role in processing tasks such as historical data.

In at least one embodiment of the present application, the acquisition of the first log data of each functional node of the person to be detected in the preset system by using the point burying technology includes:

The electronic device obtains the access behavior of the person to be detected on each functional node and the first access time when the access behavior occurs through the embedded point technology. Further, the electronic device records the access behavior and The first access time obtains the first log data of each functional node.

Among them, the burying technology is a way of collecting data for privatized deployment, which can be understood as marking and tracking data, tracking data links, and so on.

For example, the first log data may include: Person A to be detected visits functional node A at 10 o'clock, functional node B at 15:00, and functional node C at 18:00.

Through the foregoing implementation manners, the first log data can be quickly and accurately obtained, thereby facilitating the calculation of the frequency of visits to each functional node by the person to be tested.

S11: Calculate the first visit frequency of each functional node of the person to be inspected according to the first log data.

In at least one embodiment of the present application, the first visit frequency refers to the number of visits to the functional node by the person to be inspected within a unit time.

Wherein, the unit time may include a time period, etc., for example: the unit time may be 1 hour, which is not limited in this application.

In at least one embodiment of the present application, the electronic device calculating the first access frequency of each functional node of the person to be inspected according to the first log data includes:

The electronic device determines the corresponding access identifier when accessing each functional node. Further, the electronic device adopts the non-determinism Finite Automate (NFA) matching principle, from the first log data Each access identifier is identified in the, and the number of each access identifier in the unit time is calculated to obtain the first access frequency of each functional node by the person to be tested.

For example, the electronic device acquires the access identifier of the functional node A as jiediana, and further, the electronic device recognizes from the first log data that the number of jiediana in one hour is 10, therefore, The first access frequency of the functional node A is 10 times/hour.

Through the foregoing implementation manners, the frequency of visits to each functional node of the person to be detected can be accurately calculated.

S12. Invoke the target access frequency of each functional node.

In at least one embodiment of the present application, the target access frequency is determined based on the 99.7 rule of the normal distribution curve.

In at least one embodiment of the present application, before calling the target access frequency of each functional node, the method further includes:

The electronic device obtains the frequency of at least one user's access to each functional node as the second access frequency, and performs normal distribution processing on the second access frequency of each functional node to obtain the normal distribution curve of each functional node, from The third access frequency satisfying the 99.7 rule is obtained from the normal distribution curve, and the third access frequency with the highest frequency is determined as the target access frequency.

For example: the expected value for the at least one user to access the functional node A is 20 times/hour, and 99.7% of the at least one user visits the functional node A with a third visit frequency ranging from 15 times/hour to 25 Times/hour, therefore, the electronic device confirms the third most frequent visit frequency of 25 times/hour as the target visit frequency of the functional node A.

Wherein, the at least one user includes, but is not limited to: regular users with high frequency of access to each functional node, etc.

The second access frequency is the frequency at which the at least one user accesses each functional node.

For example, the frequency of user C's access to the functional node A is 10 times/hour, and the frequency of user D's access to the functional node A is 8 times/hour, so the second visit frequency of user C to the functional node A is 10 Times/hour, the second visit frequency of user D to the functional node A is 8 times/hour.

Through the above implementation, based on the 99.7 rule, the frequency of regular users' access to each functional node can be obtained, and the target access frequency of each functional node can be further determined.

S13: Compare the first access frequency of each functional node with the target access frequency of each functional node.

In at least one embodiment of the present application, after comparing the first access frequency of each functional node with the target access frequency of each functional node, the electronic device obtains a comparison result, and the comparison result may include any of the following :

(1) The first access frequency of a functional node is greater than the target access frequency.

(2) The first access frequency of each functional node is less than the target access frequency.

For example: the first visit frequency of the person under test A to visit the functional node A is 3 times/hour, the first visit frequency to visit the functional node B is 100 times/hour, and the first visit frequency to visit the functional node C A visit frequency is 4 times/hour, and the target visit frequency of the functional node A called by the electronic device is 8 times/hour, and the target visit frequency to visit the function node B is 10 times/hour. The target access frequency of the functional node C is 12 times/hour, and the electronic device compares the first access frequency of each functional node with the target access frequency of each functional node, and obtains that the comparison result is that there is a functional node B The first visit frequency is greater than the target visit frequency.

Through the foregoing implementation manners, the comparison result of the first access frequency and the target access frequency of each functional node can be obtained, and the comparison result can be used as a necessary condition for behavior detection.

S14: When the first access frequency of the functional node is greater than the target access frequency, determine from the first log data the order in which the person to be detected visits the functional node.

In at least one embodiment of the present application, the access sequence refers to the sequence in which the person to be detected accesses the functional node.

In at least one embodiment of the present application, the electronic device determining, from the first log data, the access sequence of the person to be detected to the functional node includes:

The electronic device uses a machine learning method to extract the access time of the functional nodes from the first log data, and sorts the functional nodes according to the order of the access time to obtain the access sequence of the functional nodes.

For example: it is obtained from the first log data that the access time of the functional node A is 7 o'clock this morning, the access time of the functional node B is 7:30 this morning, and the access time of the functional node C is At 8 o’clock this morning, further, the electronic device sorts the function nodes according to the order of access time, and obtains that the order of access of the function nodes is first to visit the function node A, and then to the function node B , And finally visit the functional node C.

Through the foregoing implementation manners, it is possible to accurately determine the access sequence of the person to be tested to the functional nodes, which facilitates the subsequent rapid establishment of the first queue, and then uses the access sequence as a condition for behavior detection.

S15: Establish a first queue of the functional node based on the access sequence.

In at least one embodiment of the present application, the first queue refers to a queue formed by the sequence in which the person to be tested visits each functional node.

Through the foregoing implementation manners, the first queue can be established based on the access sequence, providing basic conditions for subsequent formation of the first combination.

S16: Split the first queue to obtain a first combination for the person to be tested to access the functional node.

In at least one embodiment of the present application, the first combination is obtained by sequentially splitting the first queue.

In at least one embodiment of the present application, the splitting of the first queue by the electronic device to obtain the first combination for the person to be inspected to access the functional node includes:

The electronic device obtains the number of configuration nodes in each first combination, uses the number of configuration nodes as the number of nodes in each combination, and sequentially splits all functional nodes in the first queue to obtain the to-be-detected The first combination of personnel visiting the functional node.

Wherein, the number of configuration nodes is determined according to the number of functional nodes visited by the person to be tested, and the number of configuration nodes may be two or three, which is not limited in this application.

For example: the first queue is ABCDEF, and if the number of configuration nodes acquired by the electronic device is 2, the number of configuration nodes 2 is used as the number of nodes in each combination, and all the nodes in the first queue are sequentially split Functional node, the first combination obtained by splitting includes AB, BC, CD, DE, and EF. If the number of configuration nodes acquired by the electronic device is 3, the number of configuration nodes 3 is used as the number of nodes in each combination Count, split all the functional nodes in the first queue in turn, and the first combination obtained by splitting includes ABC, BCD, CDE, DEF.

Through the foregoing implementation manners, the first combination of the persons to be detected can be directly obtained.

S17. Retrieve a pre-configured benchmark combination.

In at least one embodiment of the present application, the reference combination is based on the number of configuration nodes, and the number of nodes retrieved from the target set is a combination of the number of configuration nodes.

In at least one embodiment of the present application, the electronic device establishes a target set before calling a pre-configured reference combination.

Specifically, establishing the target set by the electronic device includes:

Acquiring, by the electronic device, second log data of the at least one user accessing each functional node in the preset system, and extracting the access sequence of the at least one user to the functional node from the second log data, Further, the electronic device obtains the number of target nodes, uses the number of target nodes as the number of nodes in each combination, and sequentially splits the access sequence to obtain the first access sequence of the at least one user to the functional node The second combination, according to the second log data, calculate the second access frequency of each second combination in the second combination, and arrange the second combination according to the second access frequency from high to low to obtain The second queue integrates the combinations before the configuration bits in the second queue to obtain the target set.

Wherein, the number of target nodes is determined according to the number of functional nodes of the preset system, and the number of target nodes may be two or five, which is not limited in this application.

The configuration position may be 50 or 100, which is not limited in this application.

Through the foregoing implementation manners, the target set can be obtained, which is convenient for the electronic device to retrieve the reference combination as needed.

In at least one embodiment of the present application, the electronic device extracting the access sequence of the at least one user to the functional node from the second log data includes:

The electronic device obtains the target access time for the at least one user to access each functional node from the second log data, and further, the electronic device sorts the functional nodes according to the target access time to obtain The access sequence of the at least one user to the functional node.

In at least one embodiment of the present application, the method further includes:

Every second preset time, the electronic device updates the second log data, and updates the reference combination according to the updated second log data.

Wherein, the second preset time may be a time period, which is not limited in this application.

S18, matching the first combination with the reference combination.

In at least one embodiment of the present application, after matching the first combination with the reference combination, the electronic device obtains a matching result, and the matching result may include any one of the following:

(1) The first combination is successfully matched in the reference combination.

(2) There is a combination in the first combination that fails to match the reference combination.

For example: the first combination is AD, BC, CD, DE, EF, and the reference combination is AB, BC, CD, DE, EF. In the first combination, there is a failure to match AD with the reference combination.

If the first combination is successfully matched in the reference combination, the electronic device obtains the first functional node with the first access frequency greater than the target access frequency, and determines whether the first functional node belongs to the target function Node, wherein the data corresponding to the target function node contains confidential information, and when the first function node belongs to the target function node, it is determined that the behavior of the person to be detected is abnormal.

Through the foregoing implementation manners, when the first access frequency of the target functional node by the person to be detected is greater than the target access frequency, it is determined that the behavior of the person to be detected is abnormal, so that certain measures can be taken to prevent the confidentiality of the information. Give way.

S19: When there is a combination matching failure in the first combination, it is determined that the behavior of the person to be detected is abnormal.

In at least one embodiment of the present application, after determining that the behavior of the person to be detected is abnormal, the method further includes:

When it is determined that the behavior of the person to be detected is abnormal, the electronic device controls the access authority of the person to be detected to the preset system.

The electronic device obtains the first face information of the person to be detected from the monitoring device. Further, the electronic device extracts the target account for logging in to the preset system from the first log data, and obtains it from the configuration The target face information corresponding to the target account is retrieved from the database, and face recognition technology is used to determine whether the first face information matches the target face information. When the first face information matches the target face information, When the facial information matching fails, the access authority of the person to be detected to the terminal device corresponding to the target facial information is controlled.

Wherein, the monitoring equipment is composed of four parts: a camera part, a transmission part, a control part and a display part.

The configuration library includes target face information of the at least one user.

Through the above-mentioned embodiments, it is possible to prevent someone from performing abnormal operations under the guise of others.

When it is determined that the behavior of the person to be detected is abnormal, the electronic device generates alarm information, and sends the alarm information to the configuration device of the designated contact.

Wherein, the alarm information may include the name and ID of the person to be detected, the time when the abnormal behavior occurs, and the like.

Further, the designated contact person may include a user who triggers a behavior detection instruction, and the like.

Through the foregoing implementation manners, when it is determined that the behavior of the person to be detected is abnormal, an alarm and reminder can be issued in time, which is beneficial to the designated contact person to take corresponding measures in time, thereby avoiding loss.

It can be seen from the above technical solutions that this application can obtain the first log data of each functional node of the person to be detected in the preset system through the burying technique when the behavior detection instruction is received, and according to the first log data, Calculate the first visit frequency of each functional node of the person to be tested, call the target visit frequency of each functional node, compare the first visit frequency of each functional node with the target visit frequency of each functional node, when there is When the first access frequency of the functional node is greater than the target access frequency, determine the access sequence of the person to be tested to the functional node from the first log data, and establish the first access sequence of the functional node based on the access sequence. Queue, split the first queue, obtain the first combination for the person to be tested to access the functional node, call a pre-configured benchmark combination, and match the first combination with the benchmark combination, When there is a combination matching failure in the first combination, it is determined that the behavior of the person to be detected is abnormal, and the abnormal behavior can be detected more comprehensively and accurately by combining the access frequency and sequence of the functional nodes, and then remind Relevant personnel, thereby avoiding information leakage.

As shown in FIG. 2, it is a functional module diagram of a preferred embodiment of a behavior detection device based on log data analysis in this application. The behavior detection device 11 based on log data analysis includes an acquisition unit 110, a calculation unit 111, an retrieval unit 112, a comparison unit 113, a determination unit 114, an establishment unit 115, a split unit 116, a matching unit 117, a processing unit 118, The extraction unit 119, the arrangement unit 120, the integration unit 121, the judgment unit 122, the control unit 123, the update unit 124, the generation unit 125, and the transmission unit 126. The module/unit referred to in this application refers to a series of computer-readable instruction segments that can be executed by the processor 13 and can complete fixed functions, and are stored in the memory 12.

When the behavior detection instruction is received, the acquiring unit 110 acquires the first log data of each functional node of the person to be detected in the preset system by using the point burying technique.

In at least one embodiment of the present application, that the acquiring unit 110 acquires the first log data of each functional node of the person to be tested in the preset system by using the point-buried technology includes:

The acquisition unit 110 acquires the access behavior of the person to be detected on each functional node and acquires the first access time when the access behavior occurs through the burying technique. Further, the acquisition unit 110 records the access The behavior and the first access time are used to obtain the first log data of each functional node.

Through the foregoing implementation manners, the first log data can be quickly and accurately obtained, thereby facilitating calculation of the frequency of visits to each functional node by the person to be tested.

According to the first log data, the calculation unit 111 calculates the first visit frequency of each functional node of the person to be inspected.

In at least one embodiment of the present application, the calculation unit 111 calculating the first access frequency of each functional node of the person to be inspected according to the first log data includes:

The calculation unit 111 determines the corresponding access identifier when accessing each functional node. Further, the calculation unit 111 adopts the non-determinism Finite Automate (NFA) matching principle, from the first Each access identifier is identified in the log data, and the number of each access identifier per unit time is calculated to obtain the first access frequency of each functional node by the person to be tested.

For example, the computing unit 111 acquires the access identifier of the functional node A as jiediana, and further, the computing unit 111 recognizes from the first log data that the number of jiediana in one hour is 10, so , The first access frequency to the functional node A is 10 times/hour.

The retrieval unit 112 retrieves the target access frequency of each functional node.

In at least one embodiment of the present application, before calling the target access frequency of each functional node,

The acquiring unit 110 acquires the frequency of at least one user's access to each functional node as the second access frequency. Further, the processing unit 118 performs normal distribution processing on the second access frequency of each functional node to obtain each functional node Further, the obtaining unit 110 obtains a third access frequency satisfying the 99.7 rule from the normal distribution curve, and the determining unit 114 determines the third access frequency with the highest frequency as the target access frequency.

For example: the expected value for the at least one user to access the functional node A is 20 times/hour, and 99.7% of the at least one user visits the functional node A with a third visit frequency ranging from 15 times/hour to 25 Times/hour, therefore, the determining unit 114 confirms the third visit frequency with the highest frequency of 25 times/hour as the target visit frequency of the functional node A.

The comparison unit 113 compares the first access frequency of each functional node with the target access frequency of each functional node.

In at least one embodiment of the present application, after comparing the first access frequency of each functional node with the target access frequency of each functional node, the obtaining unit 110 obtains a comparison result, and the comparison result may include any one of the following Species:

For example, the first visit frequency of the person under test A to the functional node A is 3 times/hour, the first visit frequency of the functional node B is 100 times/hour, and the first visit frequency of the functional node C is 100 times/hour. A visit frequency is 4 times/hour, and the retrieved target visit frequency of the function node A is 8 times/hour, and the target visit frequency to visit the function node B is 10 times/hour, visit the function node The target visit frequency of C is 12 times/hour, and the comparison unit 113 compares the first visit frequency of each functional node with the target visit frequency of each functional node, and the comparison result is that there is the first visit of functional node B The frequency is greater than the target visit frequency.

When the first access frequency of the functional node is greater than the target access frequency, the determining unit 114 determines the order in which the person to be detected visits the functional node from the first log data.

In at least one embodiment of the present application, the determining unit 114 determining, from the first log data, the access sequence of the person to be detected to the functional node includes:

The determining unit 114 uses a machine learning method to extract the access time of the functional nodes from the first log data, and sorts the functional nodes in the order of the access time to obtain the access sequence of the functional nodes .

For example: it is obtained from the first log data that the access time of the functional node A is 7 o'clock this morning, the access time of the functional node B is 7:30 this morning, and the access time of the functional node C is At 8 o’clock this morning, further, the function nodes are sorted according to the order of access time, and the access order of the function nodes is obtained by first visiting the function node A, then visiting the function node B, and finally visiting all the function nodes. The function node C.

Based on the access sequence, the establishment unit 115 establishes the first queue of the functional node.

The splitting unit 116 splits the first queue to obtain the first combination for the person to be tested to access the functional node.

In at least one embodiment of the present application, the splitting unit 116 splits the first queue, and obtains the first combination for the person to be tested to access the functional node, including:

The splitting unit 116 obtains the number of configuration nodes in each first combination, uses the number of configuration nodes as the number of nodes in each combination, and sequentially splits all functional nodes in the first queue to obtain the The first combination for the person to be tested to visit the functional node.

For example: the first queue is ABCDEF, and if the number of configuration nodes acquired by the splitting unit 116 is 2, the number of configuration nodes 2 is used as the number of nodes in each combination, and the first queue is sequentially split The first combination obtained by splitting includes AB, BC, CD, DE, and EF. If the number of configuration nodes acquired by the splitting unit 116 is 3, the number of configuration nodes 3 is used as each The number of combined nodes is divided into all functional nodes in the first queue in turn, and the first combination obtained by the division includes ABC, BCD, CDE, and DEF.

The retrieval unit 112 retrieves a pre-configured reference combination.

In at least one embodiment of the present application, the target set is established before the pre-configured benchmark combination is retrieved.

Specifically, establishing the target set includes:

The acquiring unit 110 acquires the second log data of the at least one user's access to each functional node in the preset system, and the extracting unit 119 extracts the at least one user's response to the functional node from the second log data. Further, the acquiring unit 110 acquires the number of target nodes, and the splitting unit 116 uses the number of target nodes as the number of nodes in each combination to sequentially split the access sequence to obtain the at least According to the second log data, the calculation unit 111 calculates the second access frequency of each second combination in the second combination, and the arrangement unit 120 calculates the second combination of access to the functional node by a user. The second combination is arranged according to the second access frequency from high to low to obtain a second queue, and the integration unit 121 integrates the combinations before the positions in the second queue to obtain the target set.

Through the foregoing implementation manners, the target set can be obtained, so that the retrieval unit 112 can retrieve the reference combination as needed.

In at least one embodiment of the present application, the establishment unit 115 extracting the access sequence of the at least one user to the functional node from the second log data includes:

The establishing unit 115 obtains the target access time of the at least one user to each functional node from the second log data, and further, the establishing unit 115 sorts the functional nodes according to the target access time To obtain the access sequence of the at least one user to the functional node.

In at least one embodiment of the present application, the update unit 124 updates the second log data every second preset time, and the update unit 124 updates the reference combination according to the updated second log data.

The matching unit 117 matches the first combination with the reference combination.

In at least one embodiment of the present application, after matching the first combination with the reference combination, the obtaining unit 110 obtains a matching result, and the matching result may include any one of the following:

(1) The first combination is successfully matched in the reference combination.

In at least one embodiment of the present application, if the first combination is successfully matched in the reference combination, the acquiring unit 110 acquires the first functional node whose first access frequency is greater than the target access frequency, The judging unit 122 judges whether the first functional node belongs to the target functional node, wherein the data corresponding to the target functional node contains confidential information, and when the first functional node belongs to the target functional node, the determining unit 114 It is determined that the behavior of the person to be detected is abnormal.

When there is a combination matching failure in the first combination, the determining unit 114 determines that the behavior of the person to be detected is abnormal.

In at least one embodiment of the present application, after determining that the behavior of the person to be detected is abnormal, when the behavior of the person to be detected is determined to be abnormal, the control unit 123 controls the behavior of the person to be detected on the preset system access permission.

In at least one embodiment of the present application, after determining that the behavior of the person to be detected is abnormal, the acquiring unit 110 acquires the first face information of the person to be detected from the monitoring device, and further, the extraction The unit 119 extracts the target account that logs in to the preset system from the first log data, the retrieval unit 112 retrieves the target face information corresponding to the target account from the configuration library, and the judgment unit 122 uses The face recognition technology determines whether the first face information matches the target face information, and when the first face information matches the target face information, the control unit 123 controls the waiting Detecting personnel's access authority to the terminal device corresponding to the target face information.

In at least one embodiment of the present application, after determining that the behavior of the person to be detected is abnormal, when it is determined that the behavior of the person to be detected is abnormal, the generating unit 125 generates alarm information, and further, the sending unit 126 transmits the The alert information is sent to the configuration device of the designated contact.

It can be seen from the above technical solutions that the present application can detect abnormal behaviors more comprehensively and accurately by combining the access frequency and access sequence of the functional nodes, and then alert relevant personnel to avoid information leakage.

As shown in FIG. 3, it is a schematic structural diagram of an electronic device according to a preferred embodiment of the application for realizing a behavior detection method based on log data analysis.

The electronic device includes a processor 13 and a memory 12. The processor 13 executes the operating system of the electronic device 1 and various installed applications. The processor 13 executes the application program to implement the steps in the above embodiments of the behavior detection method based on log data analysis, such as steps S10, S11, S12, S13, S14, S15, S16, S17 shown in FIG. , S18, S19. Alternatively, when the processor 13 executes the computer-readable instructions, the functions of the modules/units in the foregoing device embodiments are implemented.

Exemplarily, the computer-readable instructions may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 12 and executed by the processor 13 to Complete this application. The one or more modules/units may be a series of computer-readable instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer-readable instructions in the electronic device 1. For example, the computer-readable instructions may be divided into units in FIG. 2.

The memory 12 may be used to store the computer-readable instructions and/or modules. The processor 13 runs or executes the computer-readable instructions and/or modules stored in the memory 12 and calls the computer-readable instructions and/or modules stored in the memory 12 The data inside realizes various functions of the electronic device 1. The memory 12 may mainly include a storage program area and a storage data area. The storage program area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may Store data created based on the use of electronic devices. In addition, the memory 12 may include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, a flash memory card (Flash Card), At least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.

The memory 12 may be an external memory and/or an internal memory of the electronic device 1. Further, the memory 12 may be a circuit with a storage function that does not have a physical form in an integrated circuit, such as FIFO (First In First Out) and so on. Alternatively, the memory 12 may also be a memory in a physical form, such as a memory stick, a TF card (Trans-flash Card), and so on.

If the integrated module/unit of the electronic device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer readable storage medium. Based on this understanding, this application implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through computer-readable instructions. The computer-readable instructions may be stored in a non-volatile memory. In the storage medium, when the computer-readable instructions are executed by the processor, the steps of the foregoing method embodiments can be implemented.

Wherein, the computer-readable instruction code may be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer-readable instruction code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory).

For the specific implementation method of the above-mentioned instructions by the processor 13, reference may be made to the description of the relevant steps in the embodiment corresponding to FIG. 1, which will not be repeated here.

The scope of this application is defined by the appended claims rather than the above description, and therefore it is intended that all changes falling within the meaning and scope of equivalent elements of the claims are included in this application. Any associated diagram marks in the claims should not be regarded as limiting the claims involved.

Claims

A behavior detection method based on log data analysis, characterized in that the method includes:

When a behavior detection instruction is received, the first log data of each functional node of the person to be detected in the preset system is obtained through the burying technique;

According to the first log data, calculate the first visit frequency of each functional node of the person to be inspected;

Retrieve the target access frequency of each functional node;

Compare the first visit frequency of each functional node with the target visit frequency of each functional node;

When the first access frequency of the functional node is greater than the target access frequency, determine the access sequence of the person to be tested to the functional node from the first log data;

Based on the access sequence, establishing the first queue of the functional node;

Splitting the first queue to obtain the first combination of access to the functional node by the person to be tested;

Retrieve the pre-configured benchmark combination;

Matching the first combination with the reference combination;

When there is a combination matching failure in the first combination, it is determined that the behavior of the person to be detected is abnormal.
The behavior detection method based on log data analysis according to claim 1, wherein the calculating the first access frequency of each functional node of the person to be detected according to the first log data comprises:

Determine the corresponding access identifier when accessing each functional node;

Using the principle of non-deterministic finite automata matching, identify each access identifier from the first log data;

Calculate the number of each access identifier in the unit time to obtain the first access frequency of each functional node of the person to be tested.
The behavior detection method based on log data analysis according to claim 1, wherein before calling the target access frequency of each functional node, the method further comprises:

Acquiring second log data of at least one user accessing each functional node;

Determining, according to the second log data, the frequency of visits by the at least one user to each functional node as the second frequency of visits;

Perform normal distribution processing on the second access frequency of each functional node to obtain the normal distribution curve of each functional node;

Obtain the third access frequency meeting the 99.7 rule from the normal distribution curve;

The third visit frequency with the highest frequency is determined as the target visit frequency.
The behavior detection method based on log data analysis according to claim 1, wherein the determining from the first log data the access sequence of the person to be detected to the functional node comprises:

Extracting the access time of the functional node from the first log data by using a machine learning method;

The functional nodes are sorted according to the order of the access time to obtain the access sequence of the functional nodes.
The behavior detection method based on log data analysis according to claim 3, characterized in that, before calling a pre-configured benchmark combination, the method further comprises:

Acquiring second log data of the at least one user accessing each functional node in the preset system;

Extracting the access sequence of the at least one user to the functional node from the second log data;

Get the number of target nodes;

Using the number of target nodes as the number of nodes in each combination, split the access sequence in turn to obtain a second combination for the at least one user to access the functional node;

Calculating the second access frequency of each second combination in the second combination according to the second log data;

Arrange the second combination according to the second access frequency from high to low to obtain a second queue;

Integrate the combinations before the configuration bits in the second queue to obtain the target set, wherein the reference combination is based on the number of configured nodes, and the number of nodes transferred from the target set is determined by The combination of the number of configured nodes.
The behavior detection method based on log data analysis of claim 5, wherein the method further comprises:

Taking the number of configuration nodes as the number of nodes in each combination, split all the functional nodes in the first queue in turn to obtain the first combination;

If the first combination is successfully matched in the reference combination, acquiring the first functional node whose first access frequency is greater than the target access frequency;

Judging whether the first function node belongs to a target function node, wherein the data corresponding to the target function node contains confidential information;

When the first functional node belongs to the target functional node, it is determined that the behavior of the person to be detected is abnormal.
The behavior detection method based on log data analysis according to claim 1, wherein after determining that the behavior of the person to be detected is abnormal, the method further comprises:

Acquiring the first face information of the person to be detected from the monitoring device;

Extracting a target account for logging in to the preset system from the first log data;

Retrieve the target face information corresponding to the target account from the configuration library;

Using a face recognition technology to determine whether the first face information matches the target face information;

When the first face information fails to match the target face information, the access authority of the person to be detected to the terminal device corresponding to the target face information is controlled.
A behavior detection device based on log data analysis, characterized in that the device includes:

The obtaining unit is configured to obtain the first log data of each functional node of the person to be detected in the preset system by using the point burying technique when the behavior detection instruction is received;

A calculation unit, configured to calculate, according to the first log data, the first visit frequency of each functional node of the person to be inspected;

The call unit is used to call the target access frequency of each functional node;

The comparison unit is used to compare the first access frequency of each functional node with the target access frequency of each functional node;

A determining unit, configured to determine, from the first log data, the order in which the person to be detected visits the functional node when the first visit frequency of the functional node is greater than the target visit frequency;

An establishment unit, configured to establish the first queue of the functional node based on the access sequence;

A splitting unit, configured to split the first queue to obtain the first combination for the person to be tested to access the functional node;

The retrieving unit is also used to retrieve a pre-configured reference combination;

A matching unit, configured to match the first combination with the reference combination;

The determining unit is further configured to determine that the behavior of the person to be detected is abnormal when there is a combination matching failure in the first combination.
An electronic device, characterized in that, the electronic device includes:

The memory stores at least one computer readable instruction; and

The processor executes the at least one computer-readable instruction to implement the following steps:

When a behavior detection instruction is received, the first log data of each functional node of the person to be detected in the preset system is obtained through the burying technique;

According to the first log data, calculate the first visit frequency of each functional node of the person to be inspected;

Retrieve the target access frequency of each functional node;

Compare the first visit frequency of each functional node with the target visit frequency of each functional node;

When the first access frequency of the functional node is greater than the target access frequency, determine the access sequence of the person to be tested to the functional node from the first log data;

Based on the access sequence, establishing the first queue of the functional node;

Splitting the first queue to obtain the first combination of access to the functional node by the person to be tested;

Retrieve the pre-configured benchmark combination;

Matching the first combination with the reference combination;

When there is a combination matching failure in the first combination, it is determined that the behavior of the person to be detected is abnormal.
The electronic device according to claim 9, wherein the processor executes at least one computer-readable instruction to implement the calculation of the first log data of the person to be tested for each functional node. For a visit frequency, the following steps are included:

Determine the corresponding access identifier when accessing each functional node;

Using the principle of non-deterministic finite automata matching, identify each access identifier from the first log data;

Calculate the number of each access identifier in the unit time to obtain the first access frequency of each functional node of the person to be tested.
9. The electronic device of claim 9, wherein the processor executes at least one computer-readable instruction before calling the target access frequency of each functional node to implement the following steps:

Acquiring second log data of at least one user accessing each functional node;

Determining, according to the second log data, the frequency of visits by the at least one user to each functional node as the second frequency of visits;

Perform normal distribution processing on the second access frequency of each functional node to obtain the normal distribution curve of each functional node;

Obtain the third access frequency meeting the 99.7 rule from the normal distribution curve;

The third visit frequency with the highest frequency is determined as the target visit frequency.
The electronic device according to claim 9, wherein the processor executes at least one computer-readable instruction to implement the determination from the first log data that the person to be inspected has access to the functional node The sequence includes the following steps:

Extracting the access time of the functional node from the first log data by using a machine learning method;

The functional nodes are sorted according to the order of the access time to obtain the access sequence of the functional nodes.
The electronic device according to claim 11, wherein, before the pre-configured reference combination is called, the processor executes at least one computer-readable instruction to further implement the following steps:

Acquiring second log data of the at least one user accessing each functional node in the preset system;

Extracting the access sequence of the at least one user to the functional node from the second log data;

Get the number of target nodes;

Taking the number of target nodes as the number of nodes in each combination, split the access sequence in turn to obtain a second combination for the at least one user to access the functional node;

Calculating the second access frequency of each second combination in the second combination according to the second log data;

Arrange the second combination according to the second access frequency from high to low to obtain a second queue;

Integrate the combinations before the configuration bits in the second queue to obtain the target set, wherein the reference combination is based on the number of configured nodes, and the number of nodes transferred from the target set is determined by The combination of the number of configured nodes.
The electronic device of claim 13, wherein the processor executing at least one computer-readable instruction is further used to implement the following steps:

Taking the number of configuration nodes as the number of nodes in each combination, split all the functional nodes in the first queue in turn to obtain the first combination;

If the first combination is successfully matched in the reference combination, acquiring the first functional node whose first access frequency is greater than the target access frequency;

Judging whether the first function node belongs to a target function node, wherein the data corresponding to the target function node contains confidential information;

When the first functional node belongs to the target functional node, it is determined that the behavior of the person to be detected is abnormal.
A non-volatile readable storage medium, wherein the non-volatile readable storage medium stores at least one computer readable instruction, and the at least one computer readable instruction is used by a processor in an electronic device Perform to achieve the following steps:

When a behavior detection instruction is received, the first log data of each functional node of the person to be detected in the preset system is obtained through the burying technique;

According to the first log data, calculate the first visit frequency of each functional node of the person to be inspected;

Retrieve the target access frequency of each functional node;

Compare the first visit frequency of each functional node with the target visit frequency of each functional node;

When the first access frequency of the functional node is greater than the target access frequency, determine the access sequence of the person to be tested to the functional node from the first log data;

Based on the access sequence, establishing the first queue of the functional node;

Splitting the first queue to obtain the first combination of access to the functional node by the person to be tested;

Retrieve the pre-configured benchmark combination;

Matching the first combination with the reference combination;

When there is a combination matching failure in the first combination, it is determined that the behavior of the person to be detected is abnormal.
The storage medium according to claim 15, wherein the at least one computer-readable instruction is executed by a processor to realize the calculation of the person’s performance of each functional node based on the first log data. For the first visit frequency, the following steps are included:

Determine the corresponding access identifier when accessing each functional node;

Using the principle of non-deterministic finite automata matching, identify each access identifier from the first log data;

Calculate the number of each access identifier in the unit time to obtain the first access frequency of each functional node of the person to be tested.
15. The storage medium according to claim 15, wherein the at least one computer-readable instruction is executed by the processor to implement the following steps before the target access frequency of each functional node is called:

Acquiring second log data of at least one user accessing each functional node;

Determining, according to the second log data, the frequency of visits by the at least one user to each functional node as the second frequency of visits;

Perform normal distribution processing on the second access frequency of each functional node to obtain the normal distribution curve of each functional node;

Obtain the third access frequency meeting the 99.7 rule from the normal distribution curve;

The third visit frequency with the highest frequency is determined as the target visit frequency.
The storage medium according to claim 15, wherein the at least one computer-readable instruction is executed by a processor to realize the determination from the first log data that the person to be inspected has an effect on the functional node The sequence of visits includes the following steps:

Extracting the access time of the functional node from the first log data by using a machine learning method;

The functional nodes are sorted according to the order of the access time to obtain the access sequence of the functional nodes.
18. The storage medium of claim 17, wherein the at least one computer readable instruction is executed by the processor to further implement the following steps before the pre-configured reference combination is retrieved:

Acquiring second log data of the at least one user accessing each functional node in the preset system;

Extracting the access sequence of the at least one user to the functional node from the second log data;

Get the number of target nodes;

Using the number of target nodes as the number of nodes in each combination, split the access sequence in turn to obtain a second combination for the at least one user to access the functional node;

Calculating the second access frequency of each second combination in the second combination according to the second log data;

Arrange the second combination according to the second access frequency from high to low to obtain a second queue;

Integrate the combinations before the configuration bits in the second queue to obtain the target set, wherein the reference combination is based on the number of configured nodes, and the number of nodes transferred from the target set is determined by The combination of the number of configured nodes.
The storage medium of claim 19, wherein the at least one computer-readable instruction is executed by the processor to further implement the following steps:

Taking the number of configuration nodes as the number of nodes in each combination, split all the functional nodes in the first queue in turn to obtain the first combination;

If the first combination is successfully matched in the reference combination, acquiring the first functional node whose first access frequency is greater than the target access frequency;

Judging whether the first function node belongs to a target function node, wherein the data corresponding to the target function node contains confidential information;

When the first functional node belongs to the target functional node, it is determined that the behavior of the person to be detected is abnormal.